IT Auditor

Audits a bank's IT systems — assessing access controls and change management. Tests firewall configurations against security standards. Assesses compliance with Kenya Data Protection Act. Reviews disaster recovery and business continuity plans. Identifies IT risks and recommends controls. Writes an audit report with findings and recommendations. Presents audit findings to management. Follows up on previous audit findings.

IT audit is a growing profession in Kenya driven by regulatory requirements and cybersecurity concerns. Key context: Kenya's regulatory environment increasingly requires IT audits — banks (CBK prudential guidelines require IT audits — security, controls, governance), government (Kenya National Audit Office — audits government IT systems), corporates (internal IT audits for governance and risk management), and data protection (Kenya Data Protection Act 2019 — requires data protection assessments). Key employers: Big 4 audit firms (PwC, KPMG, EY, Deloitte — largest IT audit practices, serve banks and large corporates), banks (internal audit departments — IT auditors on staff), CBK (bank supervision — IT auditors assessing bank IT systems), government (KENAO — government IT audits), private consulting firms. Key certifications: CISA (Certified Information Systems Auditor — ISACA — most important certification for IT auditors), CISM (Certified Information Security Manager), ISO 27001 Lead Auditor, CISSP (for cybersecurity-focused auditors). Key challenges: AI tools automating control testing and compliance checking, need for both IT and audit knowledge (most auditors are accountants — IT auditors need both), and keeping up with rapidly changing technology and regulations. Salary: entry KES 50,000-100,000 (IT audit associate at Big 4), mid KES 120,000-280,000 (IT audit senior or manager), senior KES 320,000-750,000+ (IT audit partner or head of IT audit). Big 4 firms and banks pay the highest. CISA-certified auditors command premium salaries.